On 28 June 2021, after months of anticipation, the European Commission announced that the adequacy decisions for the UK, one under the General Data Protection Regulation and the other for the Law Enforcement Directive, have been approved. This means that, while the UK has left the EU, it has remained a member of the EU privacy family.
The adoption of the adequacy decisions means that businesses and individuals (whether data controllers or processors) in the EU can freely transfer personal data from the EU to the UK, subject to certain specific exceptions.
What about transfers of personal data from the UK to the EU?
Following Brexit, the UK has decided that the EU has adequate data protection laws in place, accordingly, flow of personal data from the UK to the EU has been permitted under the UK legislative framework from 1 January 2021, meanwhile the EU has set 1 July 2021 to be the deadline for the adoption of the adequacy decisions.
Are the adequacy decisions indefinite?
It is noteworthy that the adequacy decisions include strong safeguards in case of future divergence of the UK data protection framework from that of the EU. The adequacy decisions are presently guaranteed only for an initial period of four years after entry into force, after which they will expire automatically. Nevertheless, provided that the Commission continues to be satisfied with the level of protection of personal data, the adequacy decisions will be extended for a further period.
During the period while the adequacy decisions remain in force, the Commission undertakes to monitor the UK’s approach to safeguarding personal data and, should it be dissatisfied, it may withdraw its adequacy decisions at any point. Such rigorous approach requires close cooperation between the EU and the UK. The only question that remains – is whether the decisions can stand the test of time.
Key takeaways:
- free flow of personal data from the EU to the UK as well as from the UK to the EU;
- no requirement to enter into Standard Contractual Clauses for UK-EU data transfers;
- transfers for the purposes of UK immigration control are excluded from the scope of the adequacy decision;
- adequacy decisions can be withdrawn at any point, if the UK data protection regime deviate so to no longer be deemed adequate; and
- EU data subjects can be certain that the UK upholds data subjects’ fundamental right to data protection.